7.3

CVE-2022-46908

Exploit
SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sqlite ≫ Sqlite Version >= 3.37.0 < 3.40.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.341
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.3 1.8 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.3 1.8 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://news.ycombinator.com/item?id=33948588
Third Party Advisory
Exploit
Issue Tracking
https://security.gentoo.org/glsa/202311-03
https://security.netapp.com/advisory/ntap-20230203-0005/
Third Party Advisory
https://sqlite.org/forum/forumpost/07beac8056151b2f
Vendor Advisory
Exploit
Issue Tracking
https://sqlite.org/src/info/cefc032473ac5ad2
Patch
Vendor Advisory